Entra Domain Services creation fails: "subnet ID '

Question

Entra Domain Services creation fails: "subnet ID '

Niranjan Nanjunda 0

Summary

Microsoft Entra Domain Services managed domain creation fails in a

small, cloud-only tenant. Every entry point — portal, `az deployment

group create, and direct PUTviaaz rest` — fails inside 4–8 minutes

(never reaches the "up to an hour" DC provisioning stage described in

the tutorial). The portal shows only a generic `InternalError - An

unexpected error occurred`; the CLI/REST path surfaces two distinct

specific errors that are not addressed by the current troubleshoot doc.

Environment

Region: Australia Southeast
SKU: Standard, Forest type: User
Tenant is NOT brand-new (created 2017), cloud-only users, no on-prem AD
Domain names attempted: custom `ad.

Rukmini 39,215 Reputation points Microsoft External Staff Moderator

2026-04-20T01:55:43.94+00:00
Hello Niranjan Nanjunda

Hey Niranjan, sorry you’re running into that “InternalError” / “subnet ID” issue when standing up an Entra Domain Services managed domain. Usually a failure in the 4–8 minute mark (before DC provisioning) points at network or delegation hiccups. Here are a few things to check and try:

Subnet prerequisites • Make sure the subnet is dedicated (no other resources in it) and sized at least /28. • Verify it’s delegated to Microsoft.EntraDomainServices. You should see a delegation entry if you run:
az network vnet subnet show \ --resource-group <rg> \ --vnet-name <vnet> \ --name <subnet> \ --query delegations

NSGs and UDRs • If there’s a Network Security Group on that subnet, ensure you’re allowing service-tag traffic for AzureActiveDirectory and AzureDNS (TCP/UDP 53 outbound). • Check any User-Defined Routes so you’re not forcing traffic away from Microsoft-managed endpoints.

ARM template / CLI parameters • Double-check your delegatedSubnetResourceId value in the ARM/az CLI call. It must be the full resource ID, e.g. /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Network/virtualNetworks/<vnet>/subnets/<subnet> • If you’re using az rest, compare payload against the examples in the docs to catch any typo.

Region availability • Entra Domain Services is supported in Australia Southeast, but it can be helpful to retry in a nearby region (e.g. Australia East) to rule out a temporary capacity problem.

Correlation ID & Activity Logs • Grab the correlation ID from your CLI/REST error and check the Activity log in the portal under “Deployments” → select your failed deployment → “JSON view.” That can give extra clues.

If you’ve gone through those steps and it still fails, can you share:

The exact CLI/REST error text (including correlation ID)

Output of az network vnet subnet show (with delegations)

Any NSG rules or UDRs applied to the subnet

With that info we can zero in on the root cause. Hope this helps get you unstuck!

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.
Rukmini 39,215 Reputation points Microsoft External Staff Moderator

2026-04-24T07:22:09.9333333+00:00

Hello Niranjan Nanjunda Following up to see if the above provided information was helpful. If you have any further queries do let us know.